What Type of Security Breach Redirects Users to Malicious Websites? (Pharming Explained)

28 June 2026
by: Fatima Benali
in: Server Security
Tags: dns hijacking, malicious redirect, pharming
note: no comments

Let me give you the answer first, because if you are worried about it, you deserve a clear one: the security breach that redirects users to malicious websites is called pharming. It is closely related to DNS hijacking, malicious-redirect malware, and compromised (hacked) websites that have been injected with redirect code.

Table of Contents

What makes pharming so unsettling is that the victim usually does everything right. They type the correct web address. They click nothing suspicious. And they still land on a fraudulent, look-alike site designed to steal their login details or infect their device. The redirect happens quietly, beneath the surface, at the infrastructure level — in the DNS system, a router, a server, or a website’s own code.

The good news, and I want you to hold onto this, is that pharming is preventable. Once you understand where the attack lives, you can secure exactly those places. This guide will walk you through it calmly and completely, whether you are a worried user or a website owner trying to protect your visitors. It is part of our complete guide to server security, which covers the wider picture.

Key Takeaways
• Pharming is the security breach that silently redirects users from a legitimate site to a malicious one, without them clicking a bad link.
• It works by poisoning DNS, hijacking a router or nameserver, altering a device’s hosts file, or injecting redirect code into a hacked website.
• Pharming differs from phishing: phishing tricks you into clicking; pharming reroutes you behind the scenes, so caution alone cannot save you.
• For website owners, the most common real-world version is your own site being hacked and injected with redirect code — turning your site into a weapon against your visitors.
• Defense is structural, not behavioral: secure your DNS, your registrar, and your website code; users should keep devices and routers clean.

What Exactly Is Pharming?

Pharming is a cyberattack that redirects a website’s traffic to a fraudulent destination by manipulating the systems that decide where a web address points. The name is a blend of “phishing” and “farming” — the attacker harvests victims at scale, without baiting each one individually.

Here is the core idea. When you type `yourbank.com`, your device asks the Domain Name System (DNS) to translate that human-friendly name into a numerical IP address — the actual location of the server. Pharming corrupts that translation. So even though you typed the correct address, you are quietly handed the IP address of an attacker’s server instead. The fake site is usually a pixel-perfect copy of the real one, built to capture whatever you type into it.

Because the deception happens during that invisible lookup step, there is often no visible clue in the address bar. The URL can look completely correct while the page you are viewing is not. That is precisely why pharming is more dangerous, in many ways, than the phishing attacks people are trained to spot.

How Is Pharming Different From Phishing?

People often confuse the two, so let’s separate them clearly. Both aim to land you on a malicious page — but the mechanism, and therefore your defense, is completely different.

Aspect	Phishing	Pharming
How it reaches you	A deceptive link in an email, text, or message	A silent redirect with no link to click
What the user does	Clicks a bad link and is fooled by appearance	Types the correct address and clicks nothing wrong
Where the attack lives	In the message and your judgment	In DNS, the router, the server, or website code
Address bar	Often shows a slightly wrong URL	Can show the correct URL
Can caution stop it?	Yes — don’t click suspicious links	No — the redirect happens beneath you
Main defense	User awareness and email filtering	Securing DNS, routers, servers, and site code

The short version: phishing targets your behavior; pharming targets your infrastructure. You can be the most careful person alive and still be pharmed, because the betrayal happens in the plumbing, not in the message.

How Does the Malicious Redirect Actually Happen?

A redirect can be planted in several different places. Understanding these vectors is what lets you defend the right doors. Here are the most common ones.

DNS cache poisoning. Attackers feed false records into a DNS resolver’s cache. Until that cache expires, anyone using that resolver who looks up the legitimate domain is sent to the attacker’s IP. This can affect many users at once.

Compromised router or DNS settings. Home and small-office routers are a frequent target. If an attacker changes the router’s DNS server settings — often using default or weak admin passwords — every device on that network can be silently redirected, no matter how clean each individual device is.

An altered hosts file (device malware). Every computer has a local “hosts” file that overrides DNS. Malware on a device can quietly add entries that map real domains to malicious IPs. This is pharming at the single-device level, and it travels with that infected machine everywhere it goes.

A hacked website injected with redirect code. This is the one website owners must take personally. Attackers break into a site — through outdated software, a vulnerable plugin, or stolen credentials — and inject redirect code into the pages, theme files, `.htaccess`, or database. Visitors who arrive at your legitimate URL are then bounced to a malicious or spam destination. Your own trusted site becomes the delivery mechanism. This overlaps heavily with malware infections, which is why is part of the same conversation.

Compromised nameservers or registrar account. At the highest level, if an attacker gains access to your domain registrar account or your authoritative nameservers, they can repoint your entire domain. This is the most damaging form because it affects every visitor everywhere, instantly.

What Are the Warning Signs of a Pharming Attack?

Pharming is quiet by design, but it is not invisible. These are the signals I tell people to watch for:

Unexpected redirects — you (or your visitors) land on a different site than the one requested.
The wrong site at the right URL — the address bar looks correct, but the page feels off: slightly wrong branding, odd login prompts, or unfamiliar layouts.
Browser or search-engine warnings — Chrome, Firefox, or Google flag your site as deceptive or hosting malware. For a site owner, this is a red alert.
Certificate warnings — a sudden “your connection is not private” message on a site that normally loads fine.
Visitor reports — customers telling you they were sent somewhere strange after visiting your site. Take these seriously and immediately; users on the outside often see an injected redirect before the owner does, especially if it only triggers for mobile or search-referred traffic.

Here is the uncomfortable truth at the heart of pharming, and why it deserves a different kind of defense than phishing. With phishing, you can teach people to be careful, and that caution genuinely protects them. With pharming, the victim does *everything* right — types the correct URL, clicks nothing suspicious — and still ends up on a malicious site, because the attack happens at the infrastructure layer: the DNS, the router, the server, or the website’s own compromised code. You cannot “be careful” your way out of pharming the way you can dodge a phishing email. That means the defense has to be structural, not behavioral. Site owners must secure the DNS, the registrar, and the website code — because that is where most injected-redirect hacks actually live — while users keep their devices and routers clean. For a website owner specifically, the most common real-world version of this attack is your *own* site getting hacked and injected with redirect code. Which means your site security and malware scanning are not just protecting you. They are protecting every single person who visits you.

How Do Users Protect Themselves From Pharming?

If you are an everyday internet user, your job is to keep the parts you control clean. Here is what genuinely helps:

Keep your devices clean. Run reputable anti-malware and keep it updated, so nothing can quietly edit your hosts file.
Secure your router. Change the default admin password, update the firmware, and check that its DNS settings have not been altered.
Use a trusted DNS resolver. Reputable public DNS providers offer added filtering and integrity checks against poisoning.
Watch for certificate and security warnings. Do not click past a “not private” warning on a sensitive site — that warning may be the only sign that something has been rerouted.
Verify before you type sensitive data. On banking and login pages, a moment of attention to detail and the padlock can save you.

How Do Website Owners Defend Their Site and Visitors?

This is the part I care most about, because as a site owner you are protecting not just yourself but everyone who trusts your domain. Defense falls into three layers.

Secure the website itself (where most injected redirects live).

Keep your CMS, themes, and plugins updated — outdated software is the number one entry point.
Use strong, unique credentials and enforce least-privilege access. Weak admin passwords are a gift to attackers.
Run regular malware scanning to catch injected redirect code early, before your visitors or Google find it.
Harden file permissions and lock down `.htaccess` and core files, common homes for redirect injections. Our broader walks through this in detail.

Protect your DNS and registrar.

Enable a registrar lock (domain lock) so your domain cannot be repointed or transferred without explicit unlocking.
Turn on two-factor authentication for your registrar and DNS accounts.
Enable DNSSEC, which cryptographically signs your DNS records so resolvers can detect tampering. This is a core part of .

Secure the server and connection.

Use HTTPS with a valid SSL certificate everywhere, so tampering and downgrade attacks are easier to detect.
Apply server and network firewalls and keep the underlying stack patched.
Monitor continuously for unexpected outbound redirects, new files, or unfamiliar database entries.

Defense Layer	Who Owns It	Key Actions
Website code	Site owner	Updates, strong creds, malware scanning, lock `.htaccess`
DNS & registrar	Site owner	Domain lock, 2FA, DNSSEC
Server & connection	Host / site owner	HTTPS, firewalls, patching, monitoring
Device & router	User	Anti-malware, router password, trusted DNS

A note on protecting your visitors with the right hosting partner. Because most real-world malicious redirects live inside a hacked website, the platform your site sits on matters enormously. DarazHost is built to help prevent your site from becoming a redirect weapon against your own visitors. That means malware scanning to catch injected redirect code, server and network firewalls, free SSL for trustworthy encrypted connections, and automatic backups so you can restore a clean copy fast if something does slip through. On top of the hardened platform, registrar-level domain locking helps stop attackers from repointing your domain at all. Protecting your site protects everyone who visits it — and our team is here 24/7 to help you do exactly that.

What Should You Do If Your Site Is the One Redirecting?

If you have discovered that your own site is sending visitors somewhere malicious, take a breath. This is recoverable, and acting in order matters more than acting in a panic. Here is the sequence I recommend:

Scan thoroughly. Run a full malware scan across your files and database to locate the injected redirect code. Check theme files, `.htaccess`, JavaScript, and database entries especially.
Clean or restore. Remove the malicious code — or, more reliably, restore from a known-clean backup taken before the infection. A clean restore is often faster and safer than hunting every fragment.
Change all credentials. Reset passwords for your CMS, hosting control panel, database, FTP/SSH, and your registrar and DNS accounts. Assume everything the attacker could see is compromised.
Check your DNS and registrar. Confirm your nameservers and DNS records have not been altered, and that the domain lock is on.
Patch the entry point. Update everything and close whatever vulnerability let them in, so you are not cleaning the same infection next week.
Request a review. If browsers or search engines flagged you, request a re-review once you are clean to restore your reputation.

Frequently Asked Questions

Is pharming the same as a malicious redirect? A malicious redirect is the *result* — a user being sent to a harmful site. Pharming is one of the main *methods* of achieving it, specifically by corrupting DNS or address resolution. A hacked website injected with redirect code produces the same outcome, which is why these terms are so often discussed together.

Can HTTPS and SSL alone stop pharming? Not entirely, but they help. HTTPS makes certain tampering visible through certificate warnings, and a missing or invalid certificate on a normally secure site is a useful red flag. However, a fully compromised destination can still serve its own certificate, so SSL is one important layer, not a complete shield.

What is the difference between DNS hijacking and pharming? They overlap heavily. DNS hijacking is the act of redirecting DNS queries — by altering settings, poisoning a cache, or compromising a nameserver. Pharming is the broader attack goal of redirecting users to fraudulent sites, and DNS hijacking is its most common technique.

How would I know if my router has been compromised? Watch for unexpected redirects across *all* devices on your network, changed DNS settings in the router admin panel, or an admin password that no longer works. If multiple clean devices all get redirected, suspect the router first.

Does DNSSEC fully prevent pharming? DNSSEC strongly protects against DNS-record tampering and cache poisoning by cryptographically verifying records, which closes a major pharming vector. It does not, however, protect against a website being directly hacked and injected with redirect code — that requires site-level security and malware scanning.